cybergate | 2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f

Analysis

max time kernel
158s
max time network
206s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 16:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe
Size

363KB
MD5

ebe357c385bf169ad2dfaa91da144fe1
SHA1

6013c4c104ca70f58e996390b61b3edacbbc6e4f
SHA256

2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f
SHA512

1c4880d8e8a3fa5fe7a69a6e4193b7687a1589bfb98ffa1d8b4f93c6b8c9e0863389ceeaff8a3bf87355bd3919c41480763a7e6d74c9a00fa6e31c5f4e859c3b
SSDEEP

6144:/k4qmSeorFTNGiPbHWutldo8wk0CveI0qHqG5sDhZGFohBUAu2Cyoqiyg:M9ZrFY0bHWr0veAqKsDVLu21V

Score

10^/10

cybergate vítima persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

your_dns_here:81

192.168.0.2:81

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
spynet
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\spynet\\server.exe"	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\spynet\\server.exe"	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe

Executes dropped EXE 1 IoCs

pid	Process
1176	server.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\Windows\\system32\\spynet\\server.exe Restart"	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\Windows\\system32\\spynet\\server.exe"	explorer.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1536-55-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/1536-57-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral1/memory/1536-66-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/1536-67-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/1720-72-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/files/0x000a00000001313e-74.dat	upx
behavioral1/memory/1720-75-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/1536-77-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral1/memory/1536-83-0x0000000000220000-0x000000000028D000-memory.dmp	upx
behavioral1/memory/1344-84-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/1536-85-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/1536-91-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/1344-90-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/1344-93-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/files/0x000a00000001313e-94.dat	upx
behavioral1/files/0x000a00000001313e-95.dat	upx
behavioral1/files/0x000a00000001313e-97.dat	upx
behavioral1/memory/1344-99-0x00000000046F0000-0x000000000475D000-memory.dmp	upx
behavioral1/memory/1176-101-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/1176-103-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/1344-104-0x0000000024160000-0x00000000241C2000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
1344	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe
1344	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\spynet\\server.exe"	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\spynet\\server.exe"	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\spynet\server.exe	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe
File opened for modification	C:\Windows\SysWOW64\spynet\server.exe	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe
File opened for modification	C:\Windows\SysWOW64\spynet\server.exe	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe
File opened for modification	C:\Windows\SysWOW64\spynet\	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1344	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1344	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe
Token: SeDebugPrivilege	1344	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe
820	DllHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14
PID 1536 wrote to memory of 1288	1536	2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe	14

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1288
- C:\Users\Admin\AppData\Local\Temp\2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe
  "C:\Users\Admin\AppData\Local\Temp\2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe"
  2⤵
  - Adds policy Run key to start application
  - Modifies Installed Components in the registry
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - Modifies Installed Components in the registry
    PID:1720
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:972
- - C:\Users\Admin\AppData\Local\Temp\2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe
    "C:\Users\Admin\AppData\Local\Temp\2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f.exe"
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1344
  - - C:\Windows\SysWOW64\spynet\server.exe
      "C:\Windows\system32\spynet\server.exe"
      4⤵
      Executes dropped EXE
      PID:1176

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:820

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2.jpg

Filesize
78KB

MD5
acbd09a26c06cc26c22edc356b49b5a9

SHA1
daedc3635eb9240d8bb3b57787df9f7d05a2d967

SHA256
9ef9f456d501294283f278e5584b1172e7506339ec95bb6fd27a8210952fe55e

SHA512
3cd786b92c88796ecdcabe19d275dd4c00fd47604b305dd6c17fbd435ce387ac54da4ff6bc0a013ca405563435d6cb8b550611b05c5c4f142174123c7d1ecfdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
308KB

MD5
759b5e2bf6b6268b20509e3d67cf6f34

SHA1
dc260f8b5d6580b1ff57f02fa09f27ef1fb81ce8

SHA256
00fb24010d7ce96b2594564725a50995de58b8d91134ae932297327099095e64

SHA512
14cac8a578fccbae5f3406fba388bd0bcde57f3cb6eeb0a71b5a2504d16f98206541d08b0fa14201509dd41433ad9aab4f508e5ca6bb777e1356ee072bb3001e

Download Submit
C:\Windows\SysWOW64\spynet\server.exe

Filesize
363KB

MD5
ebe357c385bf169ad2dfaa91da144fe1

SHA1
6013c4c104ca70f58e996390b61b3edacbbc6e4f

SHA256
2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f

SHA512
1c4880d8e8a3fa5fe7a69a6e4193b7687a1589bfb98ffa1d8b4f93c6b8c9e0863389ceeaff8a3bf87355bd3919c41480763a7e6d74c9a00fa6e31c5f4e859c3b

Download Submit
C:\Windows\SysWOW64\spynet\server.exe

Filesize
363KB

MD5
ebe357c385bf169ad2dfaa91da144fe1

SHA1
6013c4c104ca70f58e996390b61b3edacbbc6e4f

SHA256
2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f

SHA512
1c4880d8e8a3fa5fe7a69a6e4193b7687a1589bfb98ffa1d8b4f93c6b8c9e0863389ceeaff8a3bf87355bd3919c41480763a7e6d74c9a00fa6e31c5f4e859c3b

Download Submit
\Windows\SysWOW64\spynet\server.exe

Filesize
363KB

MD5
ebe357c385bf169ad2dfaa91da144fe1

SHA1
6013c4c104ca70f58e996390b61b3edacbbc6e4f

SHA256
2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f

SHA512
1c4880d8e8a3fa5fe7a69a6e4193b7687a1589bfb98ffa1d8b4f93c6b8c9e0863389ceeaff8a3bf87355bd3919c41480763a7e6d74c9a00fa6e31c5f4e859c3b

Download Submit
\Windows\SysWOW64\spynet\server.exe

Filesize
363KB

MD5
ebe357c385bf169ad2dfaa91da144fe1

SHA1
6013c4c104ca70f58e996390b61b3edacbbc6e4f

SHA256
2a80f26b8732d06b82077ea411410c263c96eb55c994ffdcc3933e94dd34d62f

SHA512
1c4880d8e8a3fa5fe7a69a6e4193b7687a1589bfb98ffa1d8b4f93c6b8c9e0863389ceeaff8a3bf87355bd3919c41480763a7e6d74c9a00fa6e31c5f4e859c3b

Download Submit
memory/1176-101-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1176-96-0x0000000000000000-mapping.dmp

Download
memory/1176-103-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1288-60-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/1344-104-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/1344-90-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/1344-99-0x00000000046F0000-0x000000000475D000-memory.dmp

Filesize
436KB

Download
memory/1344-81-0x0000000000000000-mapping.dmp

Download
memory/1344-100-0x00000000046F0000-0x000000000475D000-memory.dmp

Filesize
436KB

Download
memory/1344-84-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1344-93-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/1536-67-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1536-91-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1536-85-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/1536-83-0x0000000000220000-0x000000000028D000-memory.dmp

Filesize
436KB

Download
memory/1536-77-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/1536-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1536-66-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1536-57-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/1536-55-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1720-75-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1720-72-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1720-65-0x0000000075461000-0x0000000075463000-memory.dmp

Filesize
8KB

Download
memory/1720-63-0x0000000000000000-mapping.dmp

Download